Windows XP Convert SystemDrive Variable e.g. %SystemDrive% - into equivelant C++ code
-
To anyone who can help me Please? I apologise in advance if my question seems confusing noobish but I have no clue about coding in C++ hence the apparent ignorance & difficulty to me (& for some it may be a very basic question). First of all I have these lines of code that I would like to amend slightly like so:
typedef DWORD(__stdcall *CPP) (DWORD param1, PWCHAR param2, DWORD param3);
void Disable_WFP() {
hmod=LoadLibrary("sfc_os.dll");
CPP SetSfcFileException;
// the function is stored at the fifth ordinal in sfc_os.dll
SetSfcFileException=(CPP)GetProcAddress(hmod,(LPCSTR)5);
SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1);
// Now we can modify the system file in a complete stealth.
}It is not my code it belongs to Abdellatif_El_Khlifi & all credit belongs to him but I would like to make a small amendmant to his code but have no clue how to do this the alteration I would like to change this line: SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1); and alter to: (this is obviously not C++ but just trying to illustrate what I am trying to do) SetSfcFileException(0, L"%SystemDrive%\\windows\\system32\\calc.exe",-1); My question is there a equivelent C++ code for the SystemDrive variable & could someone re-code this to make the small amendmant Please to suit my needs? The reason is it will make the program more generic for me just in case say for instance my OS XP is installed on D:\\ drive instead of C:\\ drive. I have found this snippet of code that may be of help but have no clue as to how I would incorporate in the given scenario above. char *sysDrive = getenv ("SystemDrive"); or this
sysdrive = getenv("SYSTEMDRIVE");
if (sysdrive == NULL || *sysdrive == NUL)
sysdrive = "C:\\";
}Best Regards, Jackngill
jackngill wrote:
My question is there a equivelent C++ code for the SystemDrive variable...
Check out
SHGetKnownFolderPath()orSHGetFolderPath()."One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
-
jackngill wrote:
My question is there a equivelent C++ code for the SystemDrive variable...
Check out
SHGetKnownFolderPath()orSHGetFolderPath()."One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
Hi David, Thanks for your post but your answer I think is for vista & above could be wrong but my ? is related to XP Found this though: Most of the constants are based on documented CSIDL's ( http://msdn.microsoft.com/en-us/library/bb762494(v=VS.85).aspx ) except temp and quicklaunch IIRC. There is no documented api to get the systemdrive AFAIK so ReadEnvStr is as native as this is going to get. ReadEnvStr $0 "SYSTEMDRIVE" status: open --> closed But even that is not even injectable into the line SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1); as the above only states open or closed status. I think ultimately I am flogging a dead horse, was hoping for a quick easy interchange of code but looks like the answer will require multi-lines of code & I am incapable of undertaking that. But regardless many thanks for the response david
-
To anyone who can help me Please? I apologise in advance if my question seems confusing noobish but I have no clue about coding in C++ hence the apparent ignorance & difficulty to me (& for some it may be a very basic question). First of all I have these lines of code that I would like to amend slightly like so:
typedef DWORD(__stdcall *CPP) (DWORD param1, PWCHAR param2, DWORD param3);
void Disable_WFP() {
hmod=LoadLibrary("sfc_os.dll");
CPP SetSfcFileException;
// the function is stored at the fifth ordinal in sfc_os.dll
SetSfcFileException=(CPP)GetProcAddress(hmod,(LPCSTR)5);
SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1);
// Now we can modify the system file in a complete stealth.
}It is not my code it belongs to Abdellatif_El_Khlifi & all credit belongs to him but I would like to make a small amendmant to his code but have no clue how to do this the alteration I would like to change this line: SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1); and alter to: (this is obviously not C++ but just trying to illustrate what I am trying to do) SetSfcFileException(0, L"%SystemDrive%\\windows\\system32\\calc.exe",-1); My question is there a equivelent C++ code for the SystemDrive variable & could someone re-code this to make the small amendmant Please to suit my needs? The reason is it will make the program more generic for me just in case say for instance my OS XP is installed on D:\\ drive instead of C:\\ drive. I have found this snippet of code that may be of help but have no clue as to how I would incorporate in the given scenario above. char *sysDrive = getenv ("SystemDrive"); or this
sysdrive = getenv("SYSTEMDRIVE");
if (sysdrive == NULL || *sysdrive == NUL)
sysdrive = "C:\\";
}Best Regards, Jackngill
Did you try [GetEnvironmentVariable function (winbase.h) - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-getenvironmentvariable) ?
-
Hi David, Thanks for your post but your answer I think is for vista & above could be wrong but my ? is related to XP Found this though: Most of the constants are based on documented CSIDL's ( http://msdn.microsoft.com/en-us/library/bb762494(v=VS.85).aspx ) except temp and quicklaunch IIRC. There is no documented api to get the systemdrive AFAIK so ReadEnvStr is as native as this is going to get. ReadEnvStr $0 "SYSTEMDRIVE" status: open --> closed But even that is not even injectable into the line SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1); as the above only states open or closed status. I think ultimately I am flogging a dead horse, was hoping for a quick easy interchange of code but looks like the answer will require multi-lines of code & I am incapable of undertaking that. But regardless many thanks for the response david
jackngill wrote:
There is no documented api to get the systemdrive AFAIK
Maybe, maybe not. But taking the first letter of
CSIDL_SYSTEMorCSIDL_WINDOWS, for example, will get you the correct drive."One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
-
jackngill wrote:
There is no documented api to get the systemdrive AFAIK
Maybe, maybe not. But taking the first letter of
CSIDL_SYSTEMorCSIDL_WINDOWS, for example, will get you the correct drive."One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
Or using the [PathGetDriveNumberW function (shlwapi.h) - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/api/shlwapi/nf-shlwapi-pathgetdrivenumberw) and then "convert" the number to the corresponding letter
-
Or using the [PathGetDriveNumberW function (shlwapi.h) - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/api/shlwapi/nf-shlwapi-pathgetdrivenumberw) and then "convert" the number to the corresponding letter
How exactly would that function return the desired information?
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
-
How exactly would that function return the desired information?
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
AS you suggested: call any of the SHGetFolderPath(), ... with CSIDL_WINDOWS and then pass the returned path (say, windowsDir) into PathGetDriveNumber:
WCHAR letter = L'A' + PathGetDriveNumberW(windowsDir);
-
How exactly would that function return the desired information?
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
AS you suggested: call any of the SHGetFolderPath(), ... with CSIDL_WINDOWS and then pass the returned path (say, windowsDir) into PathGetDriveNumber:
WCHAR letter = L'A' + PathGetDriveNumberW(windowsDir);
-
AS you suggested: call any of the SHGetFolderPath(), ... with CSIDL_WINDOWS and then pass the returned path (say, windowsDir) into PathGetDriveNumber:
WCHAR letter = L'A' + PathGetDriveNumberW(windowsDir);
But the return value from
SHGetKnownFolderPath()already contains the system's drive letter. There's no need to pass that path toPathGetDriveNumber(), have it return a number, and then convert that number back into a drive letter that was already obtained."One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
-
But the return value from
SHGetKnownFolderPath()already contains the system's drive letter. There's no need to pass that path toPathGetDriveNumber(), have it return a number, and then convert that number back into a drive letter that was already obtained."One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
Yes, i know it. It was just a proposal to use an API rather than to search for a letter in the returned path ... :)
-
But the return value from
SHGetKnownFolderPath()already contains the system's drive letter. There's no need to pass that path toPathGetDriveNumber(), have it return a number, and then convert that number back into a drive letter that was already obtained."One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
Once more, my reply was not for you, it was just for the OP... ;) Sorry, if I put it in a wrong place! :|
-
Yes, i know it. It was just a proposal to use an API rather than to search for a letter in the returned path ... :)
Victor Nijegorodov wrote:
...rather than to search for a letter in the returned path
Search for something that's always in position 0?
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
-
Victor Nijegorodov wrote:
...rather than to search for a letter in the returned path
Search for something that's always in position 0?
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"You can easily judge the character of a man by how he treats those who can do nothing for him." - James D. Miles
:thumbsup: ;)
-
AS you suggested: call any of the SHGetFolderPath(), ... with CSIDL_WINDOWS and then pass the returned path (say, windowsDir) into PathGetDriveNumber:
WCHAR letter = L'A' + PathGetDriveNumberW(windowsDir);
Hi folks thanks for the input, PathGetDriveNumberA function Searches a path for a drive letter within the range of 'A' to 'Z' and returns the corresponding drive number. Syntax
int PathGetDriveNumberA(
LPCSTR pszPath
);Parameters pszPath Type: LPCTSTR A pointer to a null-terminated string of maximum length MAX_PATH that contains the path to be searched. Return value Type: int Returns 0 through 25 (corresponding to 'A' through 'Z') if the path has a drive letter, or -1 otherwise. Remarks Note The shlwapi.h header defines PathGetDriveNumber as an alias which automatically selects the ANSI or Unicode version of this function based on the definition of the UNICODE preprocessor constant. Mixing usage of the encoding-neutral alias with code that not encoding-neutral can lead to mismatches that result in compilation or runtime errors. For more information, see Conventions for Function Prototypes. Taken from: PathGetDriveNumberA function (shlwapi.h) - Win32 apps | Microsoft Docs[^] does this help in any way? Regards Jackngill
-
Hi folks thanks for the input, PathGetDriveNumberA function Searches a path for a drive letter within the range of 'A' to 'Z' and returns the corresponding drive number. Syntax
int PathGetDriveNumberA(
LPCSTR pszPath
);Parameters pszPath Type: LPCTSTR A pointer to a null-terminated string of maximum length MAX_PATH that contains the path to be searched. Return value Type: int Returns 0 through 25 (corresponding to 'A' through 'Z') if the path has a drive letter, or -1 otherwise. Remarks Note The shlwapi.h header defines PathGetDriveNumber as an alias which automatically selects the ANSI or Unicode version of this function based on the definition of the UNICODE preprocessor constant. Mixing usage of the encoding-neutral alias with code that not encoding-neutral can lead to mismatches that result in compilation or runtime errors. For more information, see Conventions for Function Prototypes. Taken from: PathGetDriveNumberA function (shlwapi.h) - Win32 apps | Microsoft Docs[^] does this help in any way? Regards Jackngill
jackngill wrote:
does this help in any way?
Yes. However, I'd use another way (more simple). See my post here: [Re: Windows XP Convert SystemDrive Variable e.g. %SystemDrive% - into equivelant C++ code - C / C++ / MFC Discussion Boards](https://www.codeproject.com/Messages/5747207/Re-Windows-XP-Convert-SystemDrive-Variable-e-g-Sys)
-
Did you try [GetEnvironmentVariable function (winbase.h) - Win32 apps | Microsoft Docs](https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-getenvironmentvariable) ?
Hi Victor Many thanks can I take a further liberty in answering your question with yet another question? Your "?" - Did you try GetEnvironmentVariable function (winbase.h) - Win32 apps | Microsoft Docs ? Can I answer with: Is there (of some Kind like for instance Emu8086) that would be able to run C++ code to check if it works & possibly feedback errors compatable that is compatable with XP as my skills in C++ are shall we say are very sadly lacking as suggested in my 1st post. I know what I want to do but don't know how to get there. The short answer is no sorry! I have been researching further & I have found this snippet of code from (To reveal the source click on the link below) C++/CLI Code Snippet - Access current environment directories and logical drives[^] which states this
// Gets the home drive - %HOMEDRIVE% (possible HOMEDRIVE is related to Windows7)
// Typical value - C:
Console::WriteLine("Get Environment Variable: Home Drive " + Environment::GetEnvironmentVariable("HOMEDRIVE"));However Line 15 (the last 2 lines) is all one line & it states Writeline which infers output to console? Then could Homedrive be called/injected into this line in the first post
SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1);
like this:
SetSfcFileException(0, L"HOMEDRIVE:\\windows\\system32\\calc.exe",-1);
I am assuming I would need new headers & would need to know where to insert the code. I am assuming prior to the execution of the code in the 1st post I made (which I did not write), because once the code is executed within the C++ it would remain memory resident to access later to envoke the HOMEDRIVE system variable. Hope I am not blowing smoke here just a theory? P.S. Is the C++ code in post 1 for windows or commandline as the above code I think is for commandline, I wouldn't have thought mixing code from two standpoints would Not be Good? All the best, Jackngill
-
Hi Victor Many thanks can I take a further liberty in answering your question with yet another question? Your "?" - Did you try GetEnvironmentVariable function (winbase.h) - Win32 apps | Microsoft Docs ? Can I answer with: Is there (of some Kind like for instance Emu8086) that would be able to run C++ code to check if it works & possibly feedback errors compatable that is compatable with XP as my skills in C++ are shall we say are very sadly lacking as suggested in my 1st post. I know what I want to do but don't know how to get there. The short answer is no sorry! I have been researching further & I have found this snippet of code from (To reveal the source click on the link below) C++/CLI Code Snippet - Access current environment directories and logical drives[^] which states this
// Gets the home drive - %HOMEDRIVE% (possible HOMEDRIVE is related to Windows7)
// Typical value - C:
Console::WriteLine("Get Environment Variable: Home Drive " + Environment::GetEnvironmentVariable("HOMEDRIVE"));However Line 15 (the last 2 lines) is all one line & it states Writeline which infers output to console? Then could Homedrive be called/injected into this line in the first post
SetSfcFileException(0, L"c:\\windows\\system32\\calc.exe",-1);
like this:
SetSfcFileException(0, L"HOMEDRIVE:\\windows\\system32\\calc.exe",-1);
I am assuming I would need new headers & would need to know where to insert the code. I am assuming prior to the execution of the code in the 1st post I made (which I did not write), because once the code is executed within the C++ it would remain memory resident to access later to envoke the HOMEDRIVE system variable. Hope I am not blowing smoke here just a theory? P.S. Is the C++ code in post 1 for windows or commandline as the above code I think is for commandline, I wouldn't have thought mixing code from two standpoints would Not be Good? All the best, Jackngill
jackngill wrote:
I have been researching further & I have found this snippet of code from (To reveal the source click on the link below) C++/CLI Code Snippet - Access current environment directories and logical drives[^]
The sample from CPP-CLI source has nothing to do with the native C++ code that you seem to be using! Try this:
TCHAR buffer[30] = {0};
if (::GetEnvironmentVariable(_T("SYSTEMDRIVE"), buffer, _countof(buffer)))
{
TCHAR path[MAX_PATH] = {0};
_stprintf(path, _T("%s\\windows\\system32\\calc.exe"), buffer);
TRACE(path); // just to be sure it is what we supposed...
SetSfcFileException(0, path, -1);
} -
jackngill wrote:
I have been researching further & I have found this snippet of code from (To reveal the source click on the link below) C++/CLI Code Snippet - Access current environment directories and logical drives[^]
The sample from CPP-CLI source has nothing to do with the native C++ code that you seem to be using! Try this:
TCHAR buffer[30] = {0};
if (::GetEnvironmentVariable(_T("SYSTEMDRIVE"), buffer, _countof(buffer)))
{
TCHAR path[MAX_PATH] = {0};
_stprintf(path, _T("%s\\windows\\system32\\calc.exe"), buffer);
TRACE(path); // just to be sure it is what we supposed...
SetSfcFileException(0, path, -1);
}Hi Victor, Sorry about the prior code snippet apologies. I have copied your code and ran it here: https://www.onlinegdb.com/online_c++_compiler[^] Unfortunately it came up with a few errors: Compilation failed due to following error(s). main.cpp:1:1: error: ‘TCHAR’ does not name a type TCHAR buffer[30] = {0}; ^~~~~ main.cpp:2:5: error: expected unqualified-id before ‘if’ if (::GetEnvironmentVariable(_T("SYSTEMDRIVE"), buffer, _countof(buffer))) ^~ Do these error codes mean anything to you? Best Regards David
-
Hi Victor, Sorry about the prior code snippet apologies. I have copied your code and ran it here: https://www.onlinegdb.com/online_c++_compiler[^] Unfortunately it came up with a few errors: Compilation failed due to following error(s). main.cpp:1:1: error: ‘TCHAR’ does not name a type TCHAR buffer[30] = {0}; ^~~~~ main.cpp:2:5: error: expected unqualified-id before ‘if’ if (::GetEnvironmentVariable(_T("SYSTEMDRIVE"), buffer, _countof(buffer))) ^~ Do these error codes mean anything to you? Best Regards David
I have no idea what compiler you are using... If you compile it as UNICODE then replace TCHAR with wchar_t, _T() macro - with L, and _stprintf - with swprintf. Besides, learn using Google to fast search for such types of errors...
-
I have no idea what compiler you are using... If you compile it as UNICODE then replace TCHAR with wchar_t, _T() macro - with L, and _stprintf - with swprintf. Besides, learn using Google to fast search for such types of errors...
Hi Victor, I am using online compiler as I am not setup to compile programs see link here: https://www.onlinegdb.com/online_c++_compiler[^] The file is temp called main.cpp enter the code and depress run small dialogue box at the bottom of the screen generates errors with indicators like with exchanged code as you suggested:
Compilation failed due to following error(s). main.cpp:1:8: error: expected unqualified-id before ‘,’ token
wchar_t**,** _T() buffer[30] = {0};
^
main.cpp:1:15: error: expected initializer before ‘buffer’
wchar_t, _T() buffer[30] = {0};
^~~~~~
main.cpp:2:5: error: expected unqualified-id before ‘if’
if (::GetEnvironmentVariable(_T("SYSTEMDRIVE"), buffer, _countof(buffer)))
^~For this:
wchar_t, _T() buffer[30] = {0};
if (::GetEnvironmentVariable(_T("SYSTEMDRIVE"), buffer, _countof(buffer)))
{
wchar_t, _T() path[MAX_PATH] = {0};
swprintf(path, _T("%s\windows\system32\calc.exe"), buffer);
TRACE(path); // just to be sure it is what we supposed...
SetSfcFileException(0, path, -1);
}Could not find macro - with L in your code. I will research further error codes on WWW & get back to you Best Regards David